Privacy Policy
Last updated: 31 October 2026 · English summary below
1. Who are we?
Parlyo ("we") publishes a SaaS service that adds an AI advisor (chat and voice) to its customers' websites. The service is operated by Majd Hakim, sole trader (entrepreneur individuel), trading under the business name ANATOMY of AI, registered under SIREN number 521 179 150, whose registered office is located at 16 rue Pierre Mendès France, 77200 Torcy, France. Contact for any question relating to data: contact@parlyo.io (or the site's contact form).
2. What data do we process?
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Customer account | E-mail, password (hashed, never in clear text), company name, domain | Provision of the service, invoicing | Contract |
| Sign-in with Google or Apple (optional) | If you choose “Continue with Google” or “Continue with Apple”: your e-mail address as verified by that provider, your name if provided, and a technical identifier specific to the provider, which links your account without a password. With Apple, the address may be a relay address (“Hide My Email”). We never receive your Google or Apple password, nor your contacts. The Google button is provided by Google: displaying it on the sign-up and sign-in pages contacts Google’s servers; the Apple button only contacts Apple when clicked. Google and Apple process the sign-in under their own privacy policies. | Password-free access to your account | Contract (at your request) |
| Referrals | If you signed up through a customer's link: your company name, the status of your subscription (signed up, subscribed, reward credited or not) and the reward date, visible to that customer in their dashboard — never your email address, conversations or invoices. You do not see your referrer's name. | Referral programme: telling the referrer the status of their reward | Contract (section 3b of the Terms) |
| Conversations | Messages exchanged with the AI advisor: written messages and transcripts of voice conversations (the visitor's words and the AI's answers) | Answering visitors, history for the customer, statistics | Legitimate interest of the customer |
| Voice recordings (voice on the site) | Audio recording of each voice session in the widget (the visitor's voice and the AI voice, WebM/Opus or MP4/AAC format, depending on the browser), timestamp | Follow-up of the request by the customer, record of the exchange | Legitimate interest of the customer |
| Contacts (leads) | Name, e-mail, telephone, message left voluntarily by a visitor | Forwarding the contact request to the customer concerned | Visitor's consent (voluntary action) |
| Usage | Conversation and voice-second counters, truncated IP address (last octet removed) | Quotas, invoicing, abuse prevention | Legitimate interest |
| Customer reviews | Rating, review text, author name and company supplied by the customer | Publication of testimonials on parlyo.io, after moderation | Explicit consent (checkbox), withdrawable at any time from the dashboard |
| Payment | Processed by Stripe or Revolut — we neither see nor store any card number | Collection of subscription payments | Contract |
We collect no sensitive data and we neither sell nor rent any data to third parties.
3. Telephone calls (Parlyo Phone)
When a visitor calls a number entrusted to Parlyo, the agent informs them from its very first sentence, and before they speak, of three things: they are talking to an automated assistant, the call is recorded and transcribed, and this number does not handle emergency calls. This announcement cannot be disabled by the customer operating the number.
What is kept: the audio recording and its transcription, the number called, the calling number when the carrier transmits it, the timestamp and the duration. What is not: no payment data, no health data — the agent is instructed never to ask for any, and not to rephrase, repeat or write down any that a caller might volunteer.
For how long: the audio is automatically erased after 30 days (never more than 90), by a daily purge. The transcription and the call log are kept for rolling 12 months, then deleted automatically, or as soon as the account is closed. The files are accessible only to the customer concerned, through an authenticated address: they are never exposed publicly.
On what legal basis: the recording and the transcription rely on the legitimate interest of the customer operating the number (article 6.1.f of the GDPR) — handling the request, keeping evidence of it, improving the quality of the service. They do not rely on your consent: that is why you have a right to object, and why that right must be exercisable without depriving you of the service.
Refusing to be recorded, during the call: simply tell the agent. It is required to apologise, to direct you to the written form on the site — which records no voice — and then to end the call. You do not have to hang up to assert this right, and you retain a way to reach us.
Your rights: to obtain the erasure of a recording or transcription concerning you, write to contact@parlyo.io stating the number called and the approximate date of the call. We reply within 30 days. You may also lodge a complaint with the CNIL.
3a. Voice conversations on the site
When a visitor starts voice in the widget of a site using Parlyo, the widget states as soon as the voice session opens that the voice conversation is recorded (transcript and audio) for the business's follow-up.
What is kept: the transcript of the conversation (the visitor's words and the AI's answers) and an audio recording of the session (the visitor's voice and the AI voice mixed, WebM/Opus or MP4/AAC format, depending on the browser), with the timestamp. They are stored on Parlyo's servers in the European Union and are accessible only to the customer concerned, from its authenticated dashboard, and to the Parlyo operator: they are never exposed publicly.
For how long: the audio recording is erased automatically after 30 days, by the daily purge, like call audio; the transcript is kept for rolling 12 months, like other conversations. The customer can also delete a conversation, and its recording with it, from its dashboard.
On what legal basis: the legitimate interest of the customer operating the site (following up the request, keeping a record of the exchange). You may object: do not start voice, or stop it at any time and continue in writing in the chat, which keeps no audio. Muting the microphone or pausing voice suspends the recording of your voice; stopping ends the recording, and what was said before is kept unless you request its erasure (see below).
Your rights: to have a transcript or a recording already made erased, contact the site concerned or write to contact@parlyo.io stating the site and the approximate date and time of the session.
On Parlyo's own sites (parlyo.io, Darija Live): voice conversations with the demo advisor, including the personalised trial, are kept in the same way (audio 30 days, transcript rolling 12 months), but on behalf of Parlyo, which is then the controller, to answer the visitor's request and improve the quality of the service, on the basis of its legitimate interest. To object or obtain erasure, write to contact@parlyo.io.
4. Cookies and local storage
The site uses no advertising cookies or third-party trackers. We use only:
- a strictly necessary session cookie for the customer area (dashboard);
- the browser's local storage for functional preferences (chosen language, guided tour already seen, monthly/annual preference);
- a random local anti-abuse identifier (widget), pseudonymous and not cross-referenced with your identity, used solely to limit demo voice usage per visitor;
- the code from a referral link (8 characters), kept for no more than 60 days so that it can be passed on when you sign up: the sign-up page displays it and lets you remove it, and it is erased as soon as you sign up or log in.
As these elements are strictly functional, they do not require a consent banner.
5. Where is the data hosted?
Our servers (application, database, conversations and audio recordings, contacts) are hosted in the European Union (Germany).
6. Processors
| Processor | Role | Location |
|---|---|---|
| Server host | Hosting of the application and the data, including transcripts and audio recordings | European Union (Germany) |
| Google LLC — Gemini API (Google AI for Developers) | Generation of AI answers (text and voice) and real-time transcription of voice; for voice on the site, direct browser ↔ API connection (the recording that is kept is stored on Parlyo's servers) | United States — standard contractual clauses; no training on the data (paid API) |
| Cloudflare | Content delivery network, traffic protection | Worldwide — standard contractual clauses |
| Stripe | Card payment | EU/United States — PCI-DSS certified |
| Revolut | Payment (if enabled) | EU/United Kingdom |
| CMI | Card payment in Morocco (if enabled) | Morocco |
| Google (Gmail SMTP) | Sending of notification e-mails (contacts, weekly summary) | EU/United States |
| LiveKit, Inc. | Real-time voice gateway and telephony (SIP) | European Union — processing in the Frankfurt region |
| Zadarma / IP Telecom Bulgaria | French number and routing of inbound calls | European Union |
| Tavily / Serper / DuckDuckGo | Web search, if the customer enables their agent's search tool — only the rephrased question is transmitted, never the history | EU/United States — standard contractual clauses |
| Plausible Analytics | Site audience measurement, without cookies or personal data | Self-hosted by Parlyo (EU) |
7. How long do we keep the data?
- Customer account: for the duration of the subscription, then deleted no later than 30 days after a closure request.
- Conversations: rolling 12 months, or deleted earlier at the customer's request (deletion possible conversation by conversation from the dashboard).
- Voice conversations on the site: audio recording 30 days, then automatic erasure; transcript rolling 12 months, like other conversations.
- Contacts (leads): until deleted by the customer from their dashboard, and no later than 24 months after collection.
- Customer reviews: as long as the review is published; immediate deletion upon withdrawal of consent.
- Referrals: code and history for the duration of the account; when the account is deleted, the association with the other account is anonymised (the record of a reward paid out is kept, without any identifier).
- Proposed blog articles: the text and author name you submit from the dashboard; an unpublished proposal is erased with your account; a published article stays on the blog, under the author name you chose, detached from your account.
- Invoices: 10 years (accounting obligation, French Commercial Code, art. L123-22) — they are kept even if the account is deleted.
- Usage counters: 24 months (invoicing requirement), IP always truncated.
8. Your rights (GDPR)
In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability over your data. Use the form below (immediate acknowledgement of receipt, reply within 30 days) or write to contact@parlyo.io. You may also refer the matter to the CNIL (cnil.fr).
Parlyo customers: you can delete your account and all your data directly from your dashboard (Account section → Delete my account) — immediate effect, no request needed. Only invoices are kept for 10 years (accounting obligation).
9. Security
- End-to-end TLS encryption (HTTPS everywhere).
- Hashed passwords (PBKDF2), no secret key exposed on the browser side.
- IP addresses truncated in logs, no conversation content in access logs.
- Audio recordings (calls and voice on the site) served only through an authenticated address, never exposed publicly.
- Access to data limited to the operator of the service.
10. Commitment
Your data is never resold, rented or shared for advertising purposes. It is used solely to run the service you have chosen.
English summary
Parlyo is a SaaS AI advisor (chat + voice) for websites, operated from France. Our servers and databases are hosted in the European Union (Germany). To generate answers, conversation text (and, for voice on the site, the live audio) is processed by Google's Gemini API, which may involve processing outside the EU under Standard Contractual Clauses; per Google's paid-API terms, this data is not used to train models. We use no advertising cookies or third-party trackers — only a strictly necessary session cookie and functional localStorage. We process: customer accounts (email, hashed password), widget conversations (for voice on the site: a transcript and an audio recording of the session, announced in the widget when voice starts), voluntarily submitted leads, and usage counters with truncated IPs. Payment cards are handled entirely by Stripe/Revolut. Retention: conversations 12 months (including voice transcripts; voice audio recordings 30 days), leads until deleted by the customer, accounts up to 30 days after closure. You have full GDPR rights (access, rectification, erasure, portability, objection): contact contact@parlyo.io. Data is never sold or shared for advertising.